DEV Community

Anoymask
Anoymask

Posted on

SparroWocky: A New Backdoor for Latin American Governments by FamousSparrow

#security #threatintel

1. Basic Information

2. Executive Summary

FamousSparrow has deployed a new backdoor named SparroWocky targeting government agencies in Latin America, utilizing DLL loading via legitimate programs and in-memory execution. In addition to information gathering and traffic relaying capabilities, it includes mechanisms to camouflage the host process to evade detection.

3. Attack Flow

After loading and launching the backdoor in Phase 1, attackers can utilize the command functions in Phase 2. Phase 2 covers subsequent operations of the same attack, representing an enumeration of capabilities rather than an indication that all actions were executed in the listed order.

Phase 1: Loading and Launching the Backdoor Using Legitimate Programs

  1. The attacker places three items on the target device: a legitimate executable, a malicious DLL (a dynamic-link library loaded by the program), and a data file encrypted with RC4.
  2. The loader is executed through DLL side-loading, a technique that causes the legitimate program to load the malicious DLL located nearby.
  3. The loader decrypts the data file using RC4 and deploys the main backdoor payload directly into memory for execution (the deployed payload is in PE format, but the MZ and PE magic values have been removed).
  4. Depending on the device configuration, it registers itself as a Windows service or in the Run registry key to ensure persistence after a reboot. TLS encryption is used for communication with the C2 server.

Phase 2: Information Gathering and Traffic Relaying Capabilities Available After Launch

  • Once launched, the backdoor can execute commands, perform file operations, and capture screens upon instructions from the C2. The following is an enumeration of features implemented in the sample and does not indicate execution in the listed order or across all victim environments.
  • It can execute additional PE executables or BOFs (Beacon Object Files), which are extension modules that operate directly in memory.
  • Using the infected device as a relay point, it can establish TCP connections or perform reverse port forwarding to relay communication between the C2 and other devices within the internal network. It is also capable of transmitting collected data and deleting its own files and persistence settings.

4. Attacker Location and Execution Context

  • ESET's ATT&CK mapping notes that FamousSparrow compromised target networks by abusing externally exposed Exchange servers. However, the initial access vector and specific CVEs for individual victim organizations have not been identified.
  • The loader behavior detailed in this report covers the stage after the attacker has placed the necessary files on the Windows device. The main backdoor operates within the device's memory, handling communication with the external C2 and relaying to other devices.

5. Visibility for Victims and Administrators

Victims

  • Inference: Screen capturing and in-memory code execution take place while users perform normal business operations. The absence of visual anomalies on the screen alone does not confirm that a device is uninfected.

Administrators

  • Inference: Suspicious DLLs and encrypted data files residing in the same directory as legitimate programs, newly added Windows services or Run keys, and external communication unrelated to business operations serve as clues for investigation. Relying solely on executable file names or the presence of digital signatures to determine safety must be avoided.

6. Conditions for Success and Failure

Success Conditions

  • The attacker has created an environment where a legitimate program loads a malicious DLL and possesses the privileges required to launch that legitimate program.
  • Network communication with an external C2 server must be established to enable remote control (local execution of the payload and the establishment of remote instructions/data transmission are evaluated separately).

Failure Conditions

  • Inference: If application control or DLL load restriction features successfully block the loading of unauthorized DLLs from a specified directory, the launch of the loader can be prevented.
  • Inference: If network communication to external C2 servers or internal relay destinations is blocked by a firewall, remote control and data transmission can be restricted, though this does not mean the file placement or persistence settings on the device have been removed.

7. What Happens Upon Success

  • Collection and exfiltration of files within the device, screen captures, and system information.
  • Execution of additional PE modules or BOFs, and process launching under other user session privileges.
  • Network connections to other devices abusing the infected machine as an internal proxy (the success of lateral movement itself must be separately determined from evidence on the destination device).

8. Observable Logs

Email

  • The original text contains no evidence that email was used as an initial access vector. Assumptions that users opened suspicious emails based solely on descriptions of Exchange server abuse must be avoided.

Proxy / SWG / DNS

  • Inference: Check proxy and DNS logs for external connection destination IP addresses, communication timestamps, and data volume sent/received. If the C2 server is specified using a direct IP address, no corresponding DNS resolution logs will remain. Furthermore, if communication is TLS-encrypted, malicious intent cannot be easily determined from the payload alone.

Endpoint / EDR

  • Inference: In EDR environments monitoring module loads, memory states, and configuration changes, investigate suspicious DLL loads, executable memory regions lacking the MZ/PE magic values, and modification histories of services and Run keys.
  • ESET reported an evasion technique where the thread start address is disguised as the legitimate Windows function AnimateWindow, jumping from the modified function to the actual malicious routine.
  • Inference: Do not assume safety based solely on the name of the thread start function; check for memory region discontinuities and evidence of function tampering (hooking).

Identity / IdP

  • Inference: If processes launched with another user's session privileges by the backdoor exist, cross-reference logon sessions with process generation logs. Ensure that actions reusing existing authentication tokens are not confused with successful new logons.

SaaS / Cloud

  • Direct compromises of SaaS or cloud accounts are not reported in this research material.
  • Inference: If credential theft is suspected on a device, expand the investigation to unauthorized login histories to cloud services by the corresponding account.

Network

  • Inference: Correlate outbound communication logs from the device to the external C2 server with suspicious TCP traffic logs directed from the same device to other internal machines. Identify the abuse of relay capabilities based on unnatural internal traffic, taking the device's normal role into account.

9. Attack Success Determination

Confirmed in Public Information

  • Malware Execution or Authentication Success Confirmed: Public Information: ESET observed the deployment of SparroWocky within the target organization's environment. However, the initial access outcomes for every affected organization and actual execution records of individual commands have not been publicly disclosed.

Criteria for Internal Determination

  • Malware Execution or Authentication Success Confirmed: Determination Criteria: The stage where sample files, encryption settings, and executable code in memory are analyzed on the device, and execution of the payload is confirmed by correlating with process generation and external communication logs. The mere presence of related files does not confirm successful execution.
  • Subsequent Compromise Confirmed: Determination Criteria: The stage where the execution of additional code, process launches in other user sessions, and connection traces to other devices via relay capabilities are confirmed through individual pieces of evidence.
  • Information Theft or Session Compromise Confirmed: Determination Criteria: The stage where packet logs or proxy records indicating the external transmission of internal device files or screen captures are confirmed. Simple handshake communication with a C2 server does not constitute confirmation of successful information theft.

10. Investigation Playbook

Trigger

  • Inference: Initiated by published Indicators of Compromise (IOCs), EDR detections of suspicious DLL side-loading, or memory injection alerts.

Initial Verification

  • Inference: Check the deployment status and timestamps of legitimate executables, adjacent DLLs, and encrypted data files. Record digital signatures, hash values, generation times, and parent-child process relationships.

Endpoints and Servers

  • Inference: Preserve device memory images, lists of loaded modules, service registration statuses, Run registry keys, and related suspicious files to investigate the backdoor execution state and presence of persistence.

Authentication and Cloud

  • Inference: If process execution under alternative user privileges is confirmed, investigate the usage history of the corresponding user account and token. Exfiltration of credentials themselves should be determined by cross-referencing logs outside the device.

Subsequent Operations

  • Inference: Track execution traces of added PEs or BOFs, screen/file acquisition logs, and suspicious traffic relaying to other devices. Confirm evidence of code execution and unauthorized authentication on the relay destination devices as well.

Containment

  • Inference: Immediately isolate infected devices from the network and block C2-bound traffic at the perimeter firewall. Formulate a device re-imaging and redeployment plan considering business impact and evidence preservation requirements, and promptly revoke credentials handled on compromised endpoints.

Decision Categories

  • Inference: Strictly segregate and record each phase: file placement, payload process execution, external C2 connection, subsequent lateral movement operations, and data exfiltration.

11. Defense and Detection Ideas

Single Event

  • Inference: Target behaviors where a legitimate program loads an unknown DLL from a directory it does not normally reference. Verify signature status and file paths to distinguish from legitimate software update processes.

Time-Series Correlation

  • Inference: Correlate a sequence of behaviors chronologically, including DLL side-loading, allocation of in-memory executable regions, service/registry modifications, TLS communication to external C2, and TCP connections to other devices.

Threat Hunting

  • Inference: Search internal devices by combining IOC hash values published by ESET with in-memory executable code lacking the MZ/PE magic values, modified AnimateWindow functions, and anomalous service registrations.

Log Gaps

  • ESET has reported call stack spoofing and thread start address tampering techniques.
  • Inference: Because monitoring process names or API names alone can miss the code that actually executed, memory forensics inspecting code areas and validation logs of API call stacks are necessary.

Priority Countermeasures

  • Inference: Apply DLL execution control via AppLocker or WDAC depending on the environment, and strengthen EDR memory monitoring and restrictions on suspicious outbound traffic from devices. Verify the support specifications of internal protection products and implement defense-in-depth without overreliance.

12. Facts / Inference / Hypothesis

Facts

  • ESET has observed the use of SparroWocky since at least August 2025. This malware is not an improved version of the existing SparrowDoor, but is classified as an independent new lineage.
  • Approximately 90% of FamousSparrow targets observed by ESET between mid-2025 and 2026 were concentrated in the Latin American region. SparroWocky has been confirmed in government agencies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
  • ESET's ATT&CK mapping notes intrusions through the abuse of internet-exposed Exchange servers, but specific CVEs abused in each victim organization have not been identified.
  • The loader consists of three elements: a legitimate program, a malicious DLL, and encrypted data. The decrypted payload is a PE-format executable with the MZ and PE magic values removed, deployed directly into memory without being saved to disk.
  • Sample analysis confirmed additional PE/BOF execution, TCP traffic relaying, reverse port forwarding, file operations, screen capturing, process execution in different sessions, and self-deletion capabilities. TLS is used for C2 communication.
  • ESET reported call stack spoofing and evasion processing that disguises thread start points as the legitimate API AnimateWindow.
  • ESET attributes this campaign to FamousSparrow with high confidence. Details of any association with Earth Estries remain unresolved, and Salt Typhoon is tracked separately due to insufficient technical evidence.

Inference

  • Due to the abuse of legitimate programs and API call stack spoofing, detection rules based solely on single file names, process names, or destination IP addresses are highly likely to be evaded. Monitoring should correlate module loads, executable memory regions, persistence changes, and external communications.

Hypothesis

No additional hypotheses. Unverified items are listed in "Unknowns and Additional Investigation".

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: High): ESET's mapping notes the abuse of internet-exposed Exchange servers. However, this does not indicate a common initial access vector or specific CVEs across all organizations.
  • T1574.001 Hijack Execution Flow: DLL (Confidence: High): Utilized DLL side-loading to cause a legitimate executable to load a malicious DLL.
  • T1620 Reflective Code Loading (Confidence: High): The loader decrypted encrypted data and deployed the payload PE directly into memory without passing through the disk.
  • T1090.001 Proxy: Internal Proxy (Confidence: High): A capability was confirmed to relay TCP communication between the external C2 server and other devices on the internal network via the infected device.
  • T1113 Screen Capture (Confidence: High): Implemented a capability to capture the screen of the victim device.

14. Unknowns and Additional Investigation

  • Initial access vectors in individual victim organizations, specific abused CVEs, and operational procedures leading to loader placement.
  • Details of commands actually executed in victim environments, the full scope of exfiltrated data, and the range of devices where lateral movement succeeded.
  • Existence of collaborative relationships with other threat actors such as Earth Estries, and potential spread of infection outside the Latin American region.

15. Impact on SOCs and Organizations

While approximately 90% of FamousSparrow targets observed by ESET between mid-2025 and 2026 were concentrated in Latin America, it cannot be concluded that organizations outside this region are excluded from targeting based solely on observational regional bias. The concealment techniques used by FamousSparrow—such as "DLL side-loading via legitimate executables," "in-memory loading with the MZ/PE magic values removed," and "spoofing of API call sources"—represent blind spots in monitoring Windows environments regardless of region. SOCs should establish a framework to investigate suspicious DLL placements, unregistered in-memory executable regions, and anomalous TCP communications between internal devices without relying solely on single-file signature verification.

16. Audience-Specific Summary

  • SOC: Inference: Correlate DLL side-loading by legitimate programs, in-memory code deployment, persistence settings, and external communications chronologically. Strictly distinguish between capabilities implemented in the malware and operations actually executed within the environment.
  • Administrators: Inference: Verify patch status and access permissions for internet-exposed Exchange servers and similar assets, and review DLL loading control policies and EDR memory monitoring settings on endpoints.
  • Users: Inference: If suspicious system warnings or unexpected behavior are noticed, record the time of occurrence and preceding actions, and contact the management department. Note that clear visual anomalies may not always appear on the screen.

Top comments (0)